The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads an external binary bridge from the author's GitHub repository. Specifically, it fetches a ZIP archive from https://github.com/cawcut/skill-vn/releases/download/0.1.0/vnapp-cli-darwin-universal-v0.1.0.5.zip, extracts it, and executes the contained vnapp-cli tool to interface with VN Video Editor. This is a functional dependency of the skill.
[COMMAND_EXECUTION]: The skill executes multiple local shell commands for environment discovery and workflow management. These include sw_vers to check the macOS version, uname -m to identify the CPU architecture (Apple Silicon vs. Intel), ls and awk for file size metadata, and the open command to trigger the Mac App Store for installations or updates.
[PRIVILEGE_ESCALATION]: During the installation of its bridge tool, the skill modifies file permissions using chmod +x to make the binary executable. It also attempts to strip the macOS quarantine attribute using xattr -d com.apple.quarantine to allow the downloaded tool to run without Gatekeeper interference.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of local video, audio, and SRT subtitle files provided by the user. These inputs are passed as arguments to the vnapp-cli bridge. While the skill performs basic file existence checks, the interaction with external media files and subtitle text provides an indirect injection surface if the CLI tool does not strictly sanitize all inputs.
Ingestion points: User-provided file paths for videos, audio tracks, images, and SRT subtitle files (documented in SKILL.md sections 1.1 and 1.2).
Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" warnings for the content of the processed media or subtitle files.
Capability inventory: The skill has the ability to execute shell commands, perform file system operations (move/rename output files), and interact with a third-party application (VN Video Editor).
Sanitization: The skill validates the existence of input paths using test -f and utilizes absolute paths to prevent directory traversal issues.

vn-skill